Skip to content
Fencer Vulns
high 7.5

CVE-2023-46589 json

Apache Tomcat: HTTP request smuggling via malformed trailer headers

published 2023-11-28 2 y ago modified 2026-10-02 37 d ago also BIT-tomcat-2023-46589 , EUVD-2023-2957 , GHSA-fccv-jmmp-qg76

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

Patch / fix

  • maven org.apache.tomcat:tomcat-catalina 8.5.96, 9.0.83, 10.1.16, 11.0.0-M11
  • maven org.apache.tomcat.embed:tomcat-embed-core 8.5.96, 9.0.83, 10.1.16, 11.0.0-M11
  • maven org.apache.tomcat:tomcat-coyote 11.0.0-M11
  • bitnami tomcat 8.5.96, 9.0.83, 10.1.16
  • apache tomcat 8.5.96, 9.0.83, 10.1.16
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-2
  • tomcat10 Debian 12 10.1.6-1+deb12u2
  • tomcat10 Debian 14, Debian 13 10.1.16-1

debian advisories DEBIAN-CVE-2023-46589

  • tomcat9 Ubuntu 20.04 LTS 9.0.31-1ubuntu0.7
  • tomcat9 Ubuntu 24.04 LTS 9.0.70-2ubuntu0.1
  • tomcat9 Ubuntu 25.10 9.0.70-2ubuntu1.1
  • tomcat8 Ubuntu Pro 18.04 LTS 8.5.39-1ubuntu1~18.04.3+esm3
  • tomcat9 Ubuntu Pro 18.04 LTS 9.0.16-3ubuntu0.18.04.2+esm3
  • tomcat9 Ubuntu Pro 22.04 LTS 9.0.58-1ubuntu0.1+esm3

ubuntu advisories UBUNTU-CVE-2023-46589

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tomcat RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-lib RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-webapps RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-el-5.0-api RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-docs-webapp RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-jsp-3.1-api RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-admin-webapps RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-servlet-6.0-api RHEL 10.0 1:10.1.36-1.el10_0

red hat advisories RHSA-2025:7497RHSA-2024:1134RHSA-2024:1092RHSA-2024:1318RHSA-2024:1324RHSA-2024:0539

  • tomcat SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +11 more 9.0.85-150200.57.1
  • tomcat10 SLE Module for Web and Scripting 15 SP5, openSUSE Leap 15.5 10.1.18-150200.5.8.1
  • tomcat SLES for SAP 12 SP5, SLES 12 SP5 9.0.36-3.118.1
  • tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.115-3.160.1
  • tomcat SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 9.0.36-150100.4.105.1

suse advisories SUSE-SU-2026:1058-1SUSE-SU-2024:0472-1SUSE-SU-2024:0209-1SUSE-SU-2024:0208-1SUSE-SU-2024:0206-1

  • tomcat openSUSE Tumbleweed 9.0.85-1.1
  • tomcat10 openSUSE Tumbleweed 10.1.18-1.1

opensuse advisories openSUSE-SU-2024:13590-1openSUSE-SU-2024:13596-1

  • tomcat AlmaLinux 9 1:9.0.62-37.el9_3.2
  • tomcat-lib AlmaLinux 9 1:9.0.62-37.el9_3.2
  • tomcat-webapps AlmaLinux 9 1:9.0.62-37.el9_3.2
  • tomcat-el-3.0-api AlmaLinux 9 1:9.0.62-37.el9_3.2
  • tomcat-docs-webapp AlmaLinux 9 1:9.0.62-37.el9_3.2
  • tomcat-jsp-2.3-api AlmaLinux 9 1:9.0.62-37.el9_3.2
  • tomcat-admin-webapps AlmaLinux 9 1:9.0.62-37.el9_3.2
  • tomcat-servlet-4.0-api AlmaLinux 9 1:9.0.62-37.el9_3.2

almalinux advisories ALSA-2024:1134ALSA-2024:0539

  • tomcat Rocky Linux 8 1:9.0.62-27.el8_9.3

rocky linux advisories RLSA-2024:0539

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-46589 updated cvss 7.5

tomcat: HTTP request smuggling via malformed trailer headers

  • Red Hat Decision Manager 7 tomcat
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Process Automation 7 tomcat
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JWS 5.7.8
    fixed: vendor fix RHSA-2024:1319
  • Red Hat JWS 6.0.1
    fixed: vendor fix RHSA-2024:1325
  • Red Hat Enterprise Linux AppStream (v. 8) tomcat 9.0.62-27.el8_9.3, tomcat-lib 9.0.62-27.el8_9.3, tomcat-webapps 9.0.62-27.el8_9.3, tomcat-el-3.0-api 9.0.62-27.el8_9.3, tomcat-docs-webapp 9.0.62-27.el8_9.3, tomcat-jsp-2.3-api 9.0.62-27.el8_9.3, +2 more
    fixed: vendor fix RHSA-2024:0539
  • Red Hat Enterprise Linux AppStream (v. 9) tomcat 9.0.62-37.el9_3.2, tomcat-lib 9.0.62-37.el9_3.2, tomcat-webapps 9.0.62-37.el9_3.2, tomcat-el-3.0-api 9.0.62-37.el9_3.2, tomcat-docs-webapp 9.0.62-37.el9_3.2, tomcat-jsp-2.3-api 9.0.62-37.el9_3.2, +2 more
    fixed: vendor fix RHSA-2024:1134
  • Red Hat Enterprise Linux AppStream (v. 10) tomcat 10.1.36-1.el10_0, tomcat-lib 10.1.36-1.el10_0, tomcat-webapps 10.1.36-1.el10_0, tomcat-el-5.0-api 10.1.36-1.el10_0, tomcat-docs-webapp 10.1.36-1.el10_0, tomcat-jsp-3.1-api 10.1.36-1.el10_0, +2 more
    fixed: vendor fix RHSA-2025:7497
show 6 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat 9.0.62-5.el8_8.3, tomcat-lib 9.0.62-5.el8_8.3, tomcat-webapps 9.0.62-5.el8_8.3, tomcat-el-3.0-api 9.0.62-5.el8_8.3, tomcat-docs-webapp 9.0.62-5.el8_8.3, tomcat-jsp-2.3-api 9.0.62-5.el8_8.3, +2 more
    fixed: vendor fix RHSA-2024:0532
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) tomcat 9.0.62-11.el9_2.4, tomcat-lib 9.0.62-11.el9_2.4, tomcat-webapps 9.0.62-11.el9_2.4, tomcat-el-3.0-api 9.0.62-11.el9_2.4, tomcat-docs-webapp 9.0.62-11.el9_2.4, tomcat-jsp-2.3-api 9.0.62-11.el9_2.4, +2 more
    fixed: vendor fix RHSA-2024:1092
  • Red Hat Fuse 7.13.0
    fixed: vendor fix RHSA-2024:3354
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat 9.0.62-41.redhat_00020.1.el7jws, jws5-tomcat-lib 9.0.62-41.redhat_00020.1.el7jws, jws5-tomcat-javadoc 9.0.62-41.redhat_00020.1.el7jws, jws5-tomcat-selinux 9.0.62-41.redhat_00020.1.el7jws, jws5-tomcat-webapps 9.0.62-41.redhat_00020.1.el7jws, jws5-tomcat-java-jdk8 9.0.62-41.redhat_00020.1.el7jws, +6 more Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat 9.0.62-41.redhat_00020.1.el8jws, jws5-tomcat-lib 9.0.62-41.redhat_00020.1.el8jws, jws5-tomcat-javadoc 9.0.62-41.redhat_00020.1.el8jws, jws5-tomcat-selinux 9.0.62-41.redhat_00020.1.el8jws, jws5-tomcat-webapps 9.0.62-41.redhat_00020.1.el8jws, jws5-tomcat-el-3.0-api 9.0.62-41.redhat_00020.1.el8jws, +4 more Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat 9.0.62-41.redhat_00020.1.el9jws, jws5-tomcat-lib 9.0.62-41.redhat_00020.1.el9jws, jws5-tomcat-javadoc 9.0.62-41.redhat_00020.1.el9jws, jws5-tomcat-selinux 9.0.62-41.redhat_00020.1.el9jws, jws5-tomcat-webapps 9.0.62-41.redhat_00020.1.el9jws, jws5-tomcat-el-3.0-api 9.0.62-41.redhat_00020.1.el9jws, +4 more
    fixed: vendor fix RHSA-2024:1318
  • Red Hat JBoss Web Server 6.0 for RHEL 8 jws6-tomcat 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-lib 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-javadoc 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-selinux 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-webapps 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-el-5.0-api 10.1.8-6.redhat_00013.1.el8jws, +4 more Red Hat JBoss Web Server 6.0 for RHEL 9 jws6-tomcat 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-lib 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-javadoc 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-selinux 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-webapps 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-el-5.0-api 10.1.8-6.redhat_00013.1.el9jws, +4 more
    fixed: vendor fix RHSA-2024:1324
  • Red Hat A-MQ Clients 2 tomcat Red Hat AMQ Broker 7 tomcat Red Hat build of Apache Camel for Spring Boot 3 tomcat Red Hat build of OptaPlanner 8 tomcat Red Hat Data Grid 8 tomcat Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-api, pki-servlet-container
    +13 more products
    Red Hat Enterprise Linux 9 pki-servlet-engine, pki-servlet-4.0-api Red Hat Integration Camel K 1 tomcat Red Hat JBoss Data Grid 7 tomcat Red Hat JBoss Enterprise Application Platform 6 tomcat Red Hat JBoss Enterprise Application Platform 7 tomcat Red Hat JBoss Enterprise Application Platform 8 tomcat Red Hat JBoss Enterprise Application Platform Expansion Pack tomcat Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-17.redhat_17.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native 1.2.31-17.redhat_17.el8jws Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native 1.2.31-17.redhat_17.el9jws Red Hat OpenShift Application Runtimes tomcat Red Hat Single Sign-On 7 tomcat Red Hat streams for Apache Kafka tomcat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

2.65% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat:tomcat-catalina
>=11.0.0-M1, <11.0.0-M11
>=10.1.0-M1, <10.1.16
>=9.0.0-M1, <9.0.83
>=8.5.0, <8.5.96
11.0.0-M11
10.1.16
9.0.83
8.5.96
maven org.apache.tomcat.embed:tomcat-embed-core
>=11.0.0-M1, <11.0.0-M11
>=10.1.0-M1, <10.1.16
>=9.0.0-M1, <9.0.83
>=8.5.0, <8.5.96
11.0.0-M11
10.1.16
9.0.83
8.5.96
maven org.apache.tomcat:tomcat-coyote
>=11.0.0-M1, <11.0.0-M11
11.0.0-M11
bitnami tomcat
>=8.5.0, <8.5.96
>=9.0.0, <9.0.83
>=10.1.0, <10.1.16
8.5.96
9.0.83
10.1.16

Affected products

  • Apache Software Foundation Apache Tomcat
  • apache tomcat

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.